microsoft.com scored D on its attack surface

Posture

microsoft.com

Microsoft · MSFT · Information Technology

● 11 live hosts 12 subdomains Scanned 2026-06-20

Ranks in the 44th percentile of 522 scanned peers for proactive management of its public-facing digital surface.

A › B › C › D › F Graded relative to peers — A = top 10% · F = bottom 20%

CVE Exposure45% weight

30.3 severity-weighted CVEs per live host · 30th percentile

Lower-Env Protection30% weight

100% of non-prod hosts access-controlled · 93th percentile

Security Headers25% weight

42% security-header coverage · 30th percentile

Vulnerability Exposure — version-matched CVEs

8 Critical

24 High

61 Medium

4 Low

Technology Stack — 7 detected

jQuery 16C

JavaScript Library v1.9.1

Adobe Experience Manager

CMS

Cloudflare

CDN

D3.js

JavaScript Library

Fastly

CDN

Foundation

CSS Framework

LinkedIn Insight

Advertising

Top CVEs by Severity

CVE ID	Severity	CVSS	Technology	Description
CVE-2020-26629🔒 Unlock ID	CRITICAL	9.8	jQuery v1.9.1	A JQuery Unrestricted Arbitrary File Upload vulnerability was discovered in Hospital Management System V4.0 which allows an unauthenticated … 🔒 Unlock detail
CVE-2018-9208🔒 Unlock ID	CRITICAL	9.8	jQuery v1.9.1	Unauthenticated arbitrary file upload vulnerability in jQuery Picture Cut <= v1.1Beta 🔒 Unlock detail
CVE-2018-9206🔒 Unlock ID	CRITICAL	9.8	jQuery v1.9.1	Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0 🔒 Unlock detail
CVE-2015-10138🔒 Unlock ID	CRITICAL	9.8	jQuery v1.9.1	The Work The Flow File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jQuery… 🔒 Unlock detail
CVE-2018-9207🔒 Unlock ID	CRITICAL	9.8	jQuery v1.9.1	Arbitrary file upload in jQuery Upload File <= 4.0.2 🔒 Unlock detail

Severity, CVSS, and affected technology are free. Exact CVE IDs and vulnerability descriptions — what you need to actually verify and fix each one — unlock with the free email export below, plus 99 more CVEs in the full graph explorer.

Lower-Environment Protection — access control on non-production hosts

Access

100% of 1 non-production host are access-controlled — better than 93% of 301 scanned peers.

● 1 gated

ppe.supportabilityhub.microsoft.comgated

DNS visibility is not penalised — only whether a non-prod host serves its application openly (exposed) or sits behind a network filter, auth challenge, SSO, or mutual TLS (gated).

Live Subdomains — 11 shown

account.microsoft.comauto-weseurhp-pbi-kv-httpszone74.z74.w.api.fabric.microsoft.comauto-weudp-pbi-kv-httpszone27.z27.w.api.fabric.microsoft.comemails.microsoft.comeu.icp.ids.api.iris.microsoft.comgo.microsoft.cominfo.microsoft.commicrosoft.comppe.supportabilityhub.microsoft.comprivacy.microsoft.comsupport.microsoft.com

All 104 CVEs, every host, every port — in one map

The graph explorer connects every subdomain, technology, and CVE into an interactive map — updated continuously as infrastructure changes.

Continuous scanning Version-accurate CVE matching Interactive graph explorer Corporate ecosystem tracking

Open Graph Explorer →

Free trial · plans from $49/mo · See pricing & plans →

Get the full report — PDF, CSV, or JSON

This page shows a preview — a capped subdomain list and the top 5 CVEs. Every export has every version-matched CVE, the full subdomain inventory, and every dangling-subdomain / GraphQL / historical-exposure finding for microsoft.com — the structured formats are the ones consultants actually paste into a client scope doc or feed into another tool.

No spam — just the report, and occasional NullBlocks research. Unsubscribe anytime.